Question regarding Active Directory and Linux Service Accounts

M

metril

Limp Gawd
Joined
Jun 3, 2007
Messages
414
I have several hosts (for fun at home) on which I run multiple VMs ranging from Windows to Linux derivatives. Since it has become cumbersome to manage permissions, I figured I would go ahead and setup a Domain Controller on Windows 2012 R2.

I have successfully setup Windows 2012 R2 as a PDC and ADS and have DNS queries properly routed using an override on my PFsense box (all domain members are able to query users and groups, even Linux VMs successfully do this as tested by using "getent" and "wbinfo" commands and test samba shares).

Now, I have several Linux VMs on which I run daemons. I want to granularize control through the use of "service accounts". Essentially these are accounts that will only be used for that particular daemon. How can I implement this on say Ubuntu Server and have upstart run my daemon using a "domain account"? I have tried to Google this and have been unsuccessful.

Thanks.
 
What's the end goal? (specifically, why tie daemon processes to LDAP users?)
 
By tieing to LDAP users it allows for the LDAP (PDC server) to control the UIDs and GIDs and allows for a truly central control point.
 
I may be totally wrong (and I'll admit it, I've done far more enterprise hpux/aix admin work than linux), but I've ~never~ heard of someone doing this on the linux side. Windows uses these concepts, but linux runs most daemons under init as root by design, and others as specific users for the daemon itself local only to the box.

I'm not sure if most of them are capable of performing a bind to auth the user to start the program in the first place, although I'm sure if you did some fun voodoo with the rc script you could find a way of accomplishing that.

Why do you care about the UID/GID being the same for a service user (when not root) that will never ever leave that box anyway? The services don't use that user to reach out to other machines afaik.

It's totally different for users logging into the boxes, of course - they'll need centralized auth/bind/uid/gid to keep shares/etc sane, but generally you start those at a range well outside the local users to avoid conflicts and let the daemons run as whatever they are (barring clustered apps like RAC that require identical ids for the shares).
 
Let me ask this then.

I currently run some daemons as "system users" (they have no login rights). These daemons write some files that should be accessible to select domain users and other daemons running on other VMs with a different "system user".

My goal is to grant select permissions for the domain users and "system users". That is, I want certain domain users to have both read and write permissions, certain daemons to have read and write permissions, certain domain users to only have read permissions and certain daemons to only have read permissions. I also want to deny certain domain users access to these directories.

How would you accomplish this?
 
This is getting out of my area, but sounds like you need some kind of posix acls or something?
 
I did a bit of research and it seems I will need Windows ACLs if I am dealing with Active Directory. This means that I need all of the accounts I wish to control permissions for to be controlled by Active Directory. This means that I need to run my daemons using accounts on Active Directory. Which means that even if the daemons are started by a root level init on Linux, the daemon process should run as a domain user. I can already run the daemons as a local user (system user with no login), but how do I do run the daemon as a domain user?
 
Grouping is how you do it. For the users, it's easy - set their login shells to /bin/none or something else like that in /etc/passwd (vipw to edit, don't forget!).

Then you want those, and the AD users, in teh same UNIX group. :) Make sure the directories are group read/write, and off ya go.

For some read, some read/write - that's advanced file permissions and secondary groups, and I'm not 100% sure how to do it to be honest.
 
Well, I figured out the permissions.

In essence, I wanted to have multiple users and groups per directory. I needed POSIX compliant ACLs. I was able to get this setup so that the local daemon user is set as the owner and the domain users are set as group. Then, I used ACLs to define a single domain user as having RWX permissions. So, granular control is working.

Now, I need a way to tie the daemons to Active Directory.
 
That's still a really bad idea. Daemons in unix are not designed to run having to bind for auth and there's no reason to do that (if they even will at all). Standardize on a UID semantic for them and find a way of keeping those sane that doesn't involve a central auth source. You don't want apache going down because active directory is unreachable.
 
You must log in or register to reply here.
Back
Top